3c441cbe21f02e8e9ca73ffafecc021f673cc4f41271f974f1e0f209c6a9cc95

Analysis

max time kernel
99s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 921KB
Sample260709-jlcdfses8p
SHA256 3c441cbe21f02e8e9ca73ffafecc021f673cc4f41271f974f1e0f209c6a9cc95
MD5 f3f04865d69ac1545d31a58424136ae9
SHA1 a6ee4d7487e9bf029ef3c69a88ae1300edf51f48
SHA512 97dafbaad59c8e82ffef2074447ad84a9e6e968e85a4f3db0528a3e7f0aa843510968783bcb7d8b21e946b92015b628b5419c92c7b3250e27f5d2e428f95ada3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma:A3k03kB56r
TLSH
T13E157B03E6840FA4D10F81749AA64A62EA777C125F2097DF1354AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3928-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b6f8-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3928-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b31b-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3480-48-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985e-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a72-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b6f8-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b31b-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001985e-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-490.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a72-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-650.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-893.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-912.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-931.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1091.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1135.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1167.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1205.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1320.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1339.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1364.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3480	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{A465AC7C-9A94-4346-B57A-E1C217DF6247}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3928	2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3480	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3f04865d69ac1545d31a58424136ae9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3928

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 921KB
SHA256 3c441cbe21f02e8e9ca73ffafecc021f673cc4f41271f974f1e0f209c6a9cc95
MD5 f3f04865d69ac1545d31a58424136ae9
SHA1 a6ee4d7487e9bf029ef3c69a88ae1300edf51f48
SHA512 97dafbaad59c8e82ffef2074447ad84a9e6e968e85a4f3db0528a3e7f0aa843510968783bcb7d8b21e946b92015b628b5419c92c7b3250e27f5d2e428f95ada3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma:A3k03kB56r
TLSH
T13E157B03E6840FA4D10F81749AA64A62EA777C125F2097DF1354AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0337e505f00b5143762be24cc33b68ad8ee85b52ef42ca94de04be83b6d01051
MD5 1641e95be8ef8fa81203c760908660cf
SHA1 6356a56c51fcf5cb36663c8cd9900611bdad8619
SHA512 15465511081aa6fde0b5b4d7b914940e19639ad17ecec77f0203c60426d64a02facd9180d1afd3efa1607037a478d6f6523220675ff155630c7e4bc60a1bbb6d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaP0Le5ji0hmxNrM:A3k03kB56rDPji0Aj
TLSH
T1A0654A16F6A44BA5D02BC074C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 935KB
SHA256 a59684a0172712e06e6aa2e2973b6d9d0115928e6e158c6053df02bd9deccde9
MD5 d3ff594a939c41ebc96d9d9e56a035b0
SHA1 57b75c0a4051ff810970fb8e13b7ec14cf0c2eae
SHA512 0ce1479cb0259591bd7d6a0c8b05ebe6cf59e358de40b67bf231f281a3a515e02f0fd7f6ffcf132d2c2b4d04abe8831a16314b5186d3bb9f526b40270c906ee8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaRa:A3k03kB56r
TLSH
T193157B03E6840FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 944KB
SHA256 43a1a345508c628de0d75a541a6d0a4737db9edbd06a5f1bb89e0d796aceda53
MD5 6507f17047a055da7f7da46d44af0f87
SHA1 f5a6e59cae1c9f9fc908ecd9d195a94c6adda48b
SHA512 cff6d70e2ade0c9f14cc34a920ed97d9383cd654c535d2fce140681a86251b413f9c92da01385eb10793ec0edd1238f631b509e3359a57ee9f533e1dc178e430
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mao6:A3k03kB56rr
TLSH
T177257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 944KB
SHA256 51d3921f1c09913750c3510d7ed661f80692a2e3b5b772a921671a94670d8be5
MD5 8390dd21f7a6d7172b15e0fd22437163
SHA1 31e8aac1db39431bb5369cfab87e6a889bdae29f
SHA512 61940827e1ee06feced0a06ff72ec3eb7741927878ebed9dd94044ad29f4b18af3129a56a2b582e4d8ccec8e68dec53638c9c397f429fd0bc8257682af0001e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MasN:A3k03kB56rW
TLSH
T14A257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 944KB
SHA256 3ea795a567d9e39d6c0fbbfc40d9ad2c787d61fb0ab6eb3c357d1f37c7a1c75e
MD5 fbece7097b57f1175c6153ca1e45fd42
SHA1 2bd82aab9bc1dbdca9a3b370ccada67384331b91
SHA512 b1269d1d088a1abedf43b76d1f65e4204dd36aff15fb019170c8ed06a3752ea0ec6a1c2b281b98e56d2f675679e530aa26c6896314d404486a92df5209fca05e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Maif:A3k03kB56rq
TLSH
T12A257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 944KB
SHA256 f60b6e5ae3607d44ea132f318195eb53f6cfa711dd5d8c0aad40c6a70632c06a
MD5 c79e28cd055f2e3a12bf9d13286eb8be
SHA1 404b90edc6e7ca06f7af48a55156a11bebcae3df
SHA512 269ed4cc1343c667f7bc2fa86ec5c4277d580eadccd84e92762b4d62ea88089a69ec6f7caa5528289c9b15c9127ac1114773c81a84f75a62a36377df13cc760b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma8o:A3k03kB56rz
TLSH
T187257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 944KB
SHA256 9066f6c4e4f24d09eff83a97f6fbbc25e7808a7f8ee13408d44d8d618a52bc60
MD5 d33cd63a1eb6f022be6d7c1f8c7ebd01
SHA1 c990f12ea40db468e66a78042f735c8efe88fa35
SHA512 1985977aac68cf5c1923a27cdeb05b30829f196e69b7ced08284f07edebe03a4e42c11ed8ed236ac7f7b9633f70fa3d650c33bbac596f1b14d2d30b18248b2b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Macu:A3k03kB56rl
TLSH
T1BE257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 944KB
SHA256 381d778ab54912e218112fc6d39472eaf3b49c3e1e05305e0cab1a08c2e5957f
MD5 e99cdbe412d4a67f52e36f8d95413a78
SHA1 e855b31c5843b18aae43ef38a8a8029309e119e8
SHA512 7478541fd9c843ddc8f2e3865a772ba01efaf9a2b1211e62ed1c563380a45496be03270b5f382ff444782dceae3897ae8fc73803e6a973560f302599f0d7c668
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mag9:A3k03kB56rQ
TLSH
T161257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 944KB
SHA256 e556803c27bb0e1ec8a19bf1bbea731f7510821dd943ca502d74f7314ba7bd66
MD5 b2127ac4bb9bd1e32da65ca07265ae78
SHA1 b84da37bdf63ba57b2060419bd70910ff4eb7d89
SHA512 3453db34bb6dae19046321a14c3077ad0d4061e9f7d2de8461c1fc9b44a2b58789b11a3bd330fe16224806a46e7643ae63afe91959e93ab2b53b9dcd41a4b875
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Maoc:A3k03kB56rB
TLSH
T1F7257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 944KB
SHA256 afeeabd67ddae49c41462770cb63d8b31f51c8b7073ea0a3682c3a5f6e5c5595
MD5 66e9d82f0fafbe658aba70f6f11cb718
SHA1 1b05cf0ecbb56e378d5300dc28250e7b31de57ce
SHA512 ac6ba026fe8a199704ecbc009aaac2106a80283a6963308f9667c6d7924f5cd8565d237002d2c9db81e9382f76f643ae27a7b2387a1a464eca86abe265ef1255
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaBp:A3k03kB56r/
TLSH
T109257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 944KB
SHA256 7f22d2fdcca6244df335ceb4f7382099a73a21413196d971f634a1f6120685c0
MD5 6bd6f12aeeafbd4be55542514e9e6d43
SHA1 0c2a00042e4bba6049013d5f1a6faa7a33afba22
SHA512 d26ce166517bde6eed988a74f9ab7e6dbdbb66a85dd1879ed723c3f985662e39c38a5d76dd043507a674053d9796623d4c14a568d0b58e47a6082073d02ac114
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaWN:A3k03kB56rU
TLSH
T193257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 944KB
SHA256 0e2f0a4ebbc4dad6756f17997121da3a42806ca20c681b628c64ae820d43d6cd
MD5 34dd25fcb1ff12092a47ca4d8bcfdc02
SHA1 e7cd247ad12f70aeec4d5bf3bb0404c41f641b07
SHA512 e1c96992587dc773032b80fcdb4059d7d30dbc38a2f126000cf48f914b136d8c10dc83c3b7ed68ed6a530764f7a2dd708c5286618c71aa1b34c19c5a16ec6aaa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaaF:A3k03kB56rC
TLSH
T1A8257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 944KB
SHA256 344e76449bfac9a184199e7e6cc95e20b72e02ff75e538cda0fbc5787c84c8f1
MD5 3b77730862fa0c36da916c8f28a4af53
SHA1 c4ae38562fa8b44198d3c6ca674734a291e8c87c
SHA512 34a1ed79cee89e91d26ae5ddce184bb1afe6a60b14be0b705c8d4053b0980c114ada1686686c722c7b7bd86e0b5e61fac3effc1128801904b3cb7818690f6868
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MavC:A3k03kB56rW
TLSH
T143257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 944KB
SHA256 04cb4c6e9818e0708a25447084a9d1a3783f3ef467b50cd30c15155c756c4561
MD5 9a6f125e05cb46934d493021ce06ce5e
SHA1 4932b99a7d023103554e391f29c37f0d7a9bae39
SHA512 7ef502e852785bf33a951cc2a79c6f9563ed9c3b0052d9889667ae3a55c2ca1a83ad969ed1f7e0f90efe4e35fa3b20d09cb6978c7f5a9c9aa66affa58d717211
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaQw:A3k03kB56rD
TLSH
T1E6257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 944KB
SHA256 9dec3dfa8ae9e44e9f907af541eef29b6b92d2785e6887b3bbc69c401e73971e
MD5 090f182a3473fdf6f0e4c40b2b3f79b6
SHA1 06f705d558f8cc7fc94efd8ecec20e79334afd31
SHA512 6d206b6a14b18a554097abb3f2062bd630d22974599b4acfa8c470c27196f901a3beda66343817a63036a6d2483bd23bec30d6da0bd03988cc8fc929a26e3546
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MavT:A3k03kB56rP
TLSH
T1E3257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 944KB
SHA256 9e6799f30ce4d5f315a5fee1e9ec4ced35605434b69cb5f3b9271effbfe89eb5
MD5 c783f9b5790d30e63f54d8ba1bf3cfc2
SHA1 232094752f9258690e26bef51099cc5eaa3f074d
SHA512 c1e3c689b62a5a51474b8afa8975c96bc8283cf8b0f5f292a6032c61d3c90b010fff3321b82b97ba199be348ce804fc19557fec74550836f4e603116e3440541
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mapu:A3k03kB56rg
TLSH
T10B257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 944KB
SHA256 512072a053a4a398b7cd95503f2f9f32920fc0db281207c0404a2fbb0cfe91fd
MD5 4dc3d83a42a695013494645d95ceb273
SHA1 fc0cffab011ed3d0364bfe843faca6d0b849e3ca
SHA512 2fdbe5fe7ca6a420fd7265b36fedc13c027040fcf4a9c01cf5aeea39be4c921bb8a4bfe2e0b312159770df0356b4e409635c397512d12cac01589d9713b4c444
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mahb:A3k03kB56rZ
TLSH
T12D257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 944KB
SHA256 9ee9b304c2a7b0121460a8abfae69e7a8ac172628a7a8d9575a9a5999ea4cc02
MD5 008fc881ce20e6b3142c194b1c48a490
SHA1 96abad6ed76b57aaf8a703eb21b4af972ae3c3fc
SHA512 f0496bc5da2461d4831b6883f9c6374191e3db105f7d03435da5b246c2ef3bd5b77222056bd934782437f304fc0321b052fb72516d8ed64d88a39f5b6e656c27
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mapf:A3k03kB56rp
TLSH
T155257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 944KB
SHA256 9e360037de2a11c63bbda67239d20d0357cd20a048156e32d23949bd6a26aaca
MD5 861e7788ac186e3a03fbd4f18302f490
SHA1 0ce190e7ce406109fa7061e7042732eb61a9dec5
SHA512 52063e3f311d7b57d3a339f7d5f08c67af1cfd0e280388e320b5708aa6f085309a38ab08201251985ecac71d7f5adf682bc17180d68dc413c0bbc7ff19b7dc12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaSK:A3k03kB56rB
TLSH
T137257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 944KB
SHA256 519a9b62f3577ad16ea99c84fa7351cfd44371484a466a8bcea7cd36b2cd37bb
MD5 8ae4ea8dcb56fca621f4b92571c6b219
SHA1 2106719143d3db88008572000aaad012d8f36c88
SHA512 70645da90b67b789ffe8e2c0487092bf9fcdf73e2314c153c9dc4c22294aba0cd35d8fa8c2ed979b5665c1d80b4b020ac97b7b8a374a4ab8f578a382ec10bb67
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma3k:A3k03kB56ro
TLSH
T193257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 944KB
SHA256 47336ea308d6a79df0eded8f5531490528138f801ebfccf156dfd37f13d97c2c
MD5 5110e931116f59795c4ad5acbc4f3dab
SHA1 c42d4d6664d1fd4b6f16ed0cdc0b969f7fb320d5
SHA512 f2cc8ffd92133fa2f7b93506a2dfcbbd7df221a73e52e54f6831df6f00d2e7a92bc3e6d2d8b277d6f6415098cd2bade33d9f4558a9db1eb90a5d4c6b2a6e7d5f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaA0:A3k03kB56rB
TLSH
T13F257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 944KB
SHA256 8cd987d82381bd1b4eb9d92077652579b579b1e52fa1e143db04518b2c0a8ee9
MD5 67ac96c4a7e8e9b94a35683083468aef
SHA1 e0de7dcf88fefe84710dceda38733e72e7da155f
SHA512 a5c887986961958098e07b048109634c40749199129e5e5522679cdec14047de83c1e0f3ff819f8fca7ec78451d0429ed35f35e631765d9ead39c6032a2d65fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mabg:A3k03kB56rA
TLSH
T1A5257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 944KB
SHA256 e1f9a63a9a0d46181ee70e58bbd2520419e3973ca3e117166fc5ff8a99589663
MD5 215ec7bab95da979aff64d2d5cb1f179
SHA1 dd14e397b263b41c7999729b18b6a7329cba4951
SHA512 d88aa8e4f9c802bd41e98173e0b9b344b2d85c9f7fecc4d72583f7dec38ba809dad5c3fda9989e1c532f2c97c1c011be7921c945358c2e8daecf1c9a6bd5e832
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaWr:A3k03kB56rK
TLSH
T14E257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 944KB
SHA256 18ee4e058ab92203dd894fe131ba14b0eee121126aff91b4983e91413e2e71b0
MD5 d616ef547ab0152175aae1f2b3bf7168
SHA1 dfc7643afc0368b3f7b9506c5a61d468266dddeb
SHA512 22ce6e8cc6985a69261ced4f0c451156ffd6c0f8cde74098f9013d33028cee1e0d6b89eaa26912c90a6d6f701d6e89779e7c4bab47b3018358376caeefbac178
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma8n:A3k03kB56rM
TLSH
T1E9257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 944KB
SHA256 8b461e877d47037041ed70668316673dfa863e8b813ea9accc7e1711bf7e121e
MD5 20343884797ac83d4034f28c08288cb3
SHA1 f35414381f057093db705455afdc6b9d4d80c5f6
SHA512 e2d7367670af627aa23a0d65ac55865d65ab50fe584c350df31c10d19b2b7fd42b37f35568cb9216ddabed59939d7b43289fc18a880adeddb93cbe47fd93dbe2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma6x:A3k03kB56ra
TLSH
T1A4257B03E6840FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 944KB
SHA256 e98ce61e49489ad413c420cbce28fd9104277e15d8d23a58ff7c50e466a44a8d
MD5 4e16d17f44293a6bf1d100acffd72843
SHA1 e5a07ca72daff46dfb120e2457a8ebd836f8a213
SHA512 cb7762493d4b0afcc1fed123a9804a85925f3ee4cd33893bc508264bb7d55270208d4bcd5c6b317e9d0db88545ad226c7135e7198fbac0d82aee90871e6b1739
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma8A:A3k03kB56rZ
TLSH
T1F3257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 944KB
SHA256 848322175ee9319dd45f2514e123faef52b91ab543337c18aa26cb2e9888d47c
MD5 4a8286d0d68c50b0cafa975c75104135
SHA1 2ac88974f413d786b1484996a69c6876d6b30902
SHA512 260affe2c82ed45b7eac5f398e53564b098d1332ae59306f0a71a995adaaa185d78d56e8daa2549c465fbbe588b6e06e0e2b588d4844664ab5a0daeef9eba0d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mal9Q:A3k03kB56rA
TLSH
T196257B03E6940FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 944KB
SHA256 847406acd955e95f40add4e5fc79bd645b07b1ba19385c179f8ba065f4924025
MD5 00837838199260df17a50a74e1b9887d
SHA1 d994aa3738fce1ace350f409b494b8aae3b19a95
SHA512 15999db5e349f941cb88cc943f7a1870f17b3cf44bb2ce4de921913a0423db80727bb55395a68e1fe6f3cecb00dc1f60a5c5ff3b3d29659e215ef6aa0c6a49bc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaQ4:A3k03kB56rb
TLSH
T132257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 944KB
SHA256 000373ce0d2df52e3c07592ee7fd56e58c4b0a07c1f1bc3b97a8cccf3618b7e6
MD5 0d89e9bf695a2c5f5acc86a5b2cc14eb
SHA1 f481763b7f60a304661da3982565823368074242
SHA512 8b66b6f2fd8cc5d43e6e4076987fd565a3d002f50a84a6470cc746c1efbf5ff8067a74f2e95ac713ad9da28c6ced54af60b6d6812f2702b7c28838b5d9955392
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaTu:A3k03kB56rO
TLSH
T168257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 944KB
SHA256 6ed2aff4f91c4a3f56407ddcf3e4779576089d8f43d0c0768d0cc878f5ff4fe9
MD5 9a2f7339d36e019f051856ef7c104b16
SHA1 0c778c7be0c2995192ffce6c36fb3716371dee52
SHA512 34b187a60987df0b7b45bfa0b617f43312e1e12564c3599eae3e4f895a10e9151120544229582db8cfb72d0909ff60dbe35a7efae8df5a288fa2e9387f362840
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaOj:A3k03kB56rg
TLSH
T1B3257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 944KB
SHA256 25494445e685ef5bfb932790560e49fec3b8cdcac9d2f2f53e060aa045ffa06a
MD5 7cc0794e163f9b8f337dafbfd4042726
SHA1 e525af5b067284f354c8cac587a9d6b9a23da95f
SHA512 c343160f5dd0e09b4f71ee81b3af37186898490f1bdc650ea50c377328919662fd9b153096701ead1a47d8cc555de83c66198c27bf736caa03927a17851bec91
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma7g:A3k03kB56r4
TLSH
T151257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 944KB
SHA256 98048e7c5b92cedb51fce7fb39a8ec072ecd573d4aa8412363cd9968b1370774
MD5 c211905067976cc7bdc286eaebe1aa7d
SHA1 243365e81a863ebd35c86b5d3d1b699bb9dee98d
SHA512 3920a6da3d950540bc3feddedbf05f9ca2063b9d31b4e331b46f4f89905a6413d89bd0e0863dc3501eb8cfc498514c0c23683a975f71d1dd23a744f274fb13d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MamI:A3k03kB56rJ
TLSH
T148257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 944KB
SHA256 5fefed0d7e3d3c8cc13adfdcb040b29197795ba3c7a7e98e9a3e7f5fa6ba2604
MD5 766c0a805504bd6302e9bbcfc4c20b14
SHA1 b122241162435d85ca24974cd8de9323149eac87
SHA512 e2e9c57900b8c6d366d755796a3384381f07a58315981ef373abcd22f67052ed30a0d0ccda66d1a872d023b98aebff043058eb5bbe136b09418de1d590e2ca6f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaUo:A3k03kB56r3
TLSH
T1AF257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 944KB
SHA256 6dbaba08b6fa204a112b3880ffcb1fa0bb345ae6fe58656de82a5a01aa855cce
MD5 e941f8e3f99da184d687eff3af1a38cd
SHA1 62fb5ff3598449686ae80fa74e47d04fb544ff6b
SHA512 c6e2f329e0f96f965fd9af1d868e26078e0dc500ad8b3e0ed1982e9a7acbe65a9758e8e0c6d77660eac7b776602bd53242143e3fe2bda4c4bf6844640acf5a9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Ma3+:A3k03kB56rC
TLSH
T12A257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 944KB
SHA256 e0d78ff3a7e85b06aab5e95bb7ba3a0b74912e5b5afa152b8e8ea296450aac47
MD5 7a4a2a158a848fdbc901e5b33af0f5fe
SHA1 5bb5cd86f0aecb805aae4ff1f073fbea0b6e0b02
SHA512 ae0eb953ae91182191c7c97a0382de7740fe76d94ac219a18de275813d17a9caee55238969d8bb5245bf538ed6d0f05aa991f7873df268f5c621a18a11fca8a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaNQ:A3k03kB56r2
TLSH
T123257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 944KB
SHA256 c3675d1297ec406d0df8a867e3fb765133bbc0364e1af7ea08baa0fa111a6ac3
MD5 b166528e85dee6bb138b36f5ab2dd7fb
SHA1 d897a942250b7acb39e945e8dccb27201d785462
SHA512 e5e77a0ed0f7e8e87eba814406d6a2957377932e34c6bfa46ff83c34ac6ad9baa313aa188a200b046bb5e98b6899fc2d41bd202e7f90300e892df3991bd85865
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaCX:A3k03kB56r2
TLSH
T13A257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 944KB
SHA256 2648fd8ca84bbc263858d562d67c200d891b63fadc07d01bfb000d8acc84de52
MD5 ee050268c7290562df3d8070592fb63a
SHA1 f4065a17aae18dc5ca4ec5c99f45532673727aae
SHA512 5728e9f8be3189a4f2a7c032ee82835803f4ff7acee0d0287c81f05b90d7f3359d1d7eac2affc40aa8fd923783fc1a973e549b36a9fdcf0e740ac4fe8954929a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MakL:A3k03kB56r4
TLSH
T1B5257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 944KB
SHA256 3ef2eae394792efbeafe24742097a6b6573d830abb63db938d6c1b815407f1f2
MD5 a02e4a2a61bd64116297bdd4605732f9
SHA1 6f7c11f32736e537aa777bda77623c633017fc36
SHA512 84e432c319eb4973aebdca0cc438d009807d7189212b9d31bfa16948e6ceea445f624ecec4b1e0697ab12172f17d8b9932a4215d9f286eb64300b96fbee5deb0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3MaAM:A3k03kB56rZ
TLSH
T1D4257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 944KB
SHA256 e57aa9e00476432f0a43e5367c69b8c621a4137faa1217b4279f65b4680a0155
MD5 2c5ffaa5f2eb8a46c92b78d637812139
SHA1 7b8decaa70feb8d1fcb5e4a14a48aae1cc0655d6
SHA512 05627f012110f3c4f7b8f59f95cf61747db86c35f6b3eff52d31328b135ab5a3c3f70f42edec2871376f6f3db2767e3b2f1293ccbc27fbeb9461d417efa71eb7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKah3Mahh:A3k03kB56rL
TLSH
T125257B03E6840FA4D10F81749AA64662EA777C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3480-48-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3928-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3928-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads